Proceedings of the 2015 Workshop on Automated Decision Making for Active Cyber Defense最新文献

Estimating Risk Boundaries for Persistent and Stealthy Cyber-Attacks 评估持续和隐形网络攻击的风险边界

Proceedings of the 2015 Workshop on Automated Decision Making for Active Cyber Defense Pub Date : 2015-10-12 DOI: 10.1145/2809826.2809830

M. S. Awan, P. Burnap, O. Rana

{"title":"Estimating Risk Boundaries for Persistent and Stealthy Cyber-Attacks","authors":"M. S. Awan, P. Burnap, O. Rana","doi":"10.1145/2809826.2809830","DOIUrl":"https://doi.org/10.1145/2809826.2809830","url":null,"abstract":"Increasingly mature, stealthy and dynamic techniques and attack vectors used by cyber criminals have made network infrastructure more vulnerable to security breaches. Moreover, cyber-attacks involving advanced evasion techniques often bypass security controls, and even if detected at a later time could still remain in the system for a long time without any monitorable trace. Such types of cyber-attacks are costing billions of dollars to the organizations across the globe. This dynamic and complex threat landscape demands a network administrator to understand the nature, patterns and risks of cyber-attacks targeting the network infrastructure so that appropriate measures could be introduced. In this paper we propose: (i) a framework to formally characterize the features of such advanced persistent threats, (ii) propose a security metric to calculate risk based on characteristics of such threats, and (iii) estimate risk boundaries for persistent and stealthy cyber-attacks. We validate and analyze the application of our proposed risk framework using real-world traffic logs acquired from an Intrusion Detection/Prevention System.","PeriodicalId":303467,"journal":{"name":"Proceedings of the 2015 Workshop on Automated Decision Making for Active Cyber Defense","volume":"44 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-10-12","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121176908","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 2

FlowMon: Detecting Malicious Switches in Software-Defined Networks FlowMon:检测软件定义网络中的恶意交换机

Proceedings of the 2015 Workshop on Automated Decision Making for Active Cyber Defense Pub Date : 2015-10-12 DOI: 10.1145/2809826.2809833

Andrzej Kamisiński, Carol J. Fung

{"title":"FlowMon: Detecting Malicious Switches in Software-Defined Networks","authors":"Andrzej Kamisiński, Carol J. Fung","doi":"10.1145/2809826.2809833","DOIUrl":"https://doi.org/10.1145/2809826.2809833","url":null,"abstract":"Software-Defined Networking (SDN) introduces a new communication network management paradigm and has gained much attention recently. In SDN, a network controller overlooks and manages the entire network by configuring routing mechanisms for underlying switches. The switches report their status to the controller periodically, such as port statistics and flow statistics, according to their communication protocol. However, switches may contain vulnerabilities that can be exploited by attackers. A compromised switch may not only lose its normal functionality, but it may also maliciously paralyze the network by creating network congestions or packet loss. Therefore, it is important for the system to be able to detect and isolate malicious switches. In this work, we investigate a methodology for an SDN controller to detect compromised switches through real-time analysis of the periodically collected reports. Two types of malicious behavior of compromised switches are investigated: packet dropping and packet swapping. We proposed two anomaly detection algorithms to detect packet droppers and packet swappers. Our simulation results show that our proposed methods can effectively detect packet droppers and swappers. To the best of our knowledge, our work is the first to address malicious switches detection using statistics reports in SDN.","PeriodicalId":303467,"journal":{"name":"Proceedings of the 2015 Workshop on Automated Decision Making for Active Cyber Defense","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-10-12","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121416018","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 55

Action Recommendation for Cyber Resilience 网络复原力行动建议

Proceedings of the 2015 Workshop on Automated Decision Making for Active Cyber Defense Pub Date : 2015-10-12 DOI: 10.1145/2809826.2809837

Sutanay Choudhury, Luke Rodriguez, Darren S. Curtis, Kiri Oler, P. Nordquist, Pin-Yu Chen, I. Ray

引用次数: 13

Integrated Adaptive Cyber Defense: Integration Spiral Results 集成自适应网络防御:集成螺旋结果

Proceedings of the 2015 Workshop on Automated Decision Making for Active Cyber Defense Pub Date : 2015-10-12 DOI: 10.1145/2809826.2809827

W. Peters

{"title":"Integrated Adaptive Cyber Defense: Integration Spiral Results","authors":"W. Peters","doi":"10.1145/2809826.2809827","DOIUrl":"https://doi.org/10.1145/2809826.2809827","url":null,"abstract":"Integrated Adaptive Cyber Defense (IACD) is the secure integration and automation across a diverse, changeable set of cyber defense capabilities. It is intended to dramatically change the timelines needed to defend computer enterprises, while maintaining operational and acquisition freedom by allowing 'plug and play'-type use of capabilities as they emerge. IACD applies the construct that commercially available solutions can be interconnected to greater impact and effectiveness than the individual parts, and that a gradual, industry-influenced transition towards interoperability can be achieved. Johns Hopkins Applied Physics Laboratory (JH-APL) leads the IACD agile architecture, capability demonstration and assessment efforts within the Federated Innovation, Integration and Research Environment (FIIRE). In capability-driven spirals, commercial technologies are integrated and deployed across live and virtualized environments, demonstrating their applicability and effectiveness for improved network operations efficiency and more rapid cyber defense operations. The results, challenges, and gaps are communicated to Government and vendor communities at engagement sessions following every spiral. This presentation summarizes the results of the first several IACD spirals and describes the challenges targeted for future spirals. It also introduces the options for partnering with network owners and operators to allow them to leverage lessons from these spirals within their own enterprises.","PeriodicalId":303467,"journal":{"name":"Proceedings of the 2015 Workshop on Automated Decision Making for Active Cyber Defense","volume":"49 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-10-12","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114935275","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Cyber Resilience-by-Construction: Modeling, Measuring & Verifying 网络建设弹性:建模、测量与验证

Proceedings of the 2015 Workshop on Automated Decision Making for Active Cyber Defense Pub Date : 2015-10-12 DOI: 10.1145/2809826.2809836

Yasir Imtiaz Khan, E. Al-Shaer, Usman Rauf

{"title":"Cyber Resilience-by-Construction: Modeling, Measuring & Verifying","authors":"Yasir Imtiaz Khan, E. Al-Shaer, Usman Rauf","doi":"10.1145/2809826.2809836","DOIUrl":"https://doi.org/10.1145/2809826.2809836","url":null,"abstract":"The need of cyber security is increasing as cyber attacks are escalating day by day. Cyber attacks are now so many and sophisticated that many will unavoidably get through. Therefore, there is an immense need to employ resilient architectures to defend known or unknown threats. Engineer- ing resilient system/infrastructure is a challenging task, that implies how to measure the resilience and how to obtain sufficient resilience necessary to maintain its service delivery under diverse situations. This paper has two fold objective, the first is to propose a formal approach to measure cyber resilience from different aspects (i.e., attacks, failures) and at different levels (i.e., pro-active, resistive and reactive). To achieve the first objective, we propose a formal frame- work named as: Cyber Resilience Engineering Framework (CREF). The second objective is to build a resilient system by construction. The idea is to build a formal model of a cyber system, which is initially not resilient with respect to attacks. Then by systematic refinements of the formal model and by its model checking, we attain resiliency. We exemplify our technique through the case study of simple cyber security device (i.e., network firewall).","PeriodicalId":303467,"journal":{"name":"Proceedings of the 2015 Workshop on Automated Decision Making for Active Cyber Defense","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-10-12","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130470727","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 7

Who Touched My Mission: Towards Probabilistic Mission Impact Assessment 谁触动了我的使命:走向概率使命影响评估

Proceedings of the 2015 Workshop on Automated Decision Making for Active Cyber Defense Pub Date : 2015-10-12 DOI: 10.1145/2809826.2809834

Xiaoyan Sun, A. Singhal, Peng Liu

引用次数: 12

Behavior-dependent Routing: Responding to Anomalies with Automated Low-cost Measures 行为依赖路由:用自动化低成本措施响应异常

Proceedings of the 2015 Workshop on Automated Decision Making for Active Cyber Defense Pub Date : 2015-10-12 DOI: 10.1145/2809826.2809835

C. Oehmen, T. E. Carroll, Patrick C. Paulson, D. Best, C. Noonan, S. R. Thompson, Jeffrey L. Jensen, Glenn A. Fink, Elena S. Peterson

{"title":"Behavior-dependent Routing: Responding to Anomalies with Automated Low-cost Measures","authors":"C. Oehmen, T. E. Carroll, Patrick C. Paulson, D. Best, C. Noonan, S. R. Thompson, Jeffrey L. Jensen, Glenn A. Fink, Elena S. Peterson","doi":"10.1145/2809826.2809835","DOIUrl":"https://doi.org/10.1145/2809826.2809835","url":null,"abstract":"As cyber attacks on enterprise systems and critical infrastructure increase in prevalence and severity, persistent presence of adversaries in these systems is a common theme. While there are many efforts and tools focused on locating and removing adversaries from cyber systems, there is an increasing need for automated, steerable response that happens in attack-relevant time scales-an active cyber defense. The research presented here describes design and implementation of a system (SEQUESTOR) to achieve a form of active defense at the network layer by using the output of multiple behavior models to drive differential routing of traffic through a core network. This approach is based on two assertions: 1) methods for detecting behavior that are inconsistent with a user's past are a proxy for compromised systems or credentials, but are subject to high rate of false positives; and 2) automatically changing the logical route taken by future traffic emanating from the potentially compromised system provides a means for graded response that makes is possible to balance the cost of false positive with the risk of allowing the behavior to continue. The presented system is a framework that combines behavior models in a modular way and allows for future models and responses to be incorporated. Ultimately, this is a model for how real-time situational awareness technologies can be coupled to automated responses as well as supporting steerable responses that provide decision support to human operators.","PeriodicalId":303467,"journal":{"name":"Proceedings of the 2015 Workshop on Automated Decision Making for Active Cyber Defense","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-10-12","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130657454","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 2

Using Probability Densities to Evolve more Secure Software Configurations 使用概率密度进化更安全的软件配置

Proceedings of the 2015 Workshop on Automated Decision Making for Active Cyber Defense Pub Date : 2015-10-12 DOI: 10.1145/2809826.2809831

Caroline A. Odell, Matthew R. McNiece, Sarah K. Gage, H. Gage, E. Fulp

{"title":"Using Probability Densities to Evolve more Secure Software Configurations","authors":"Caroline A. Odell, Matthew R. McNiece, Sarah K. Gage, H. Gage, E. Fulp","doi":"10.1145/2809826.2809831","DOIUrl":"https://doi.org/10.1145/2809826.2809831","url":null,"abstract":"The use of Evolutionary Algorithms (EAs) is one method for securing software configurations in a changing environment. Using this approach, configurations are modeled as biological chromosomes, and a continual sequence of selection, recombination, and mutation processes is performed. While this approach can evolve secure configurations based on current conditions, it is also possible to inadvertently lose solutions to previous threats during the evolution process. This paper improves the performance of EA-based configuration management by incorporating parameter-setting history. Over the generations (EA iterations), counts are maintained regarding the parameter-settings and the security of the configuration. Probability densities are then developed and used during mutation to encourage the selection of previously secure settings. As a result, these secure settings are likely to be maintained as attacks alternate between vulnerabilities. Experimental results using configuration parameters from RedHat Linux installed Apache web-servers indicate the addition of parameter history significantly improves the ability to maintain secure settings as an attacker alternates between different threats.","PeriodicalId":303467,"journal":{"name":"Proceedings of the 2015 Workshop on Automated Decision Making for Active Cyber Defense","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-10-12","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130460629","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 3

Automated Decision Making for Active Cyber Defense: Panel Discussion 主动网络防御的自动化决策:小组讨论

Proceedings of the 2015 Workshop on Automated Decision Making for Active Cyber Defense Pub Date : 2015-10-12 DOI: 10.1145/2809826.2809828

C. Oehmen, E. Al-Shaer, M. Rahman

{"title":"Automated Decision Making for Active Cyber Defense: Panel Discussion","authors":"C. Oehmen, E. Al-Shaer, M. Rahman","doi":"10.1145/2809826.2809828","DOIUrl":"https://doi.org/10.1145/2809826.2809828","url":null,"abstract":"The high growth of cyber connectivity significantly increases the potential and sophistication of cyber-attacks. New capabilities based on active cyber defense (ACD) are required to offer automated, intelligently-driven, agile, and resilient cyber defense. Both accurate \"sense-making\" based security analytics of the system artifacts (e.g., traces, configurations, logs, incident reports, alarms and network traffic), and provably-effective \"decision-making\" based on robust reasoning are required to enable ACD for cyber security and resiliency. In this panel session, a collection of academic, government, and national laboratory representatives will discuss current drivers and emerging research priorities for ACD technologies. Scheduled panelists include Phil Quade (NSA), Arlette Hart (FBI), Ehab Al-Shaer (UNCC), and Chris Oehmen (PNNL). The panel will focus on the impact of new emerging cyber technologies on the future of resilience and the realization of ACD technologies. Example emerging technologies include clouds/data centers, cyber-physical systems, software defined networking, and Internet of things.","PeriodicalId":303467,"journal":{"name":"Proceedings of the 2015 Workshop on Automated Decision Making for Active Cyber Defense","volume":"243 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-10-12","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131536300","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Session details: Keynote 会议详情:

Proceedings of the 2015 Workshop on Automated Decision Making for Active Cyber Defense Pub Date : 2015-10-12 DOI: 10.1145/3252357

W. Peters

引用次数: 0